How to Run Claude Code from GitHub Actions with a Local Bearer-Token Proxy

How to Run Claude Code from GitHub Actions with a Local Bearer-Token Proxy

When a repository grows beyond a handful of files, the hardest part of AI-assisted coding is not asking the model a question; it is putting the assistant close enough to the pull request, issue, and codebase that it can do useful work without breaking your workflow.

This guide walks through a practical GitHub Actions setup for Claude Code: a maintainer writes @claude in an issue or pull request comment, GitHub Actions starts a runner, a tiny local proxy adapts authentication, and Claude Code runs against the repository using Ace Data Cloud as the upstream API gateway.

What you can do

With the workflow described in the source documentation, you can turn GitHub issues and review comments into repository-aware Claude Code tasks. The action can be triggered from:

  • issue_comment events when a new comment contains @claude
  • pull_request_review_comment events when a review comment contains @claude
  • pull_request_review submissions when the review body contains @claude
  • issues events when a newly opened or assigned issue title or body contains @claude

The workflow can read the repository, comment back through the GitHub bot, and operate with the permissions explicitly granted in the workflow: contents: write, pull-requests: write, issues: write, and id-token: write. That makes it useful for small automation tasks such as reproducing a bug, proposing a patch, reviewing a diff, or answering a maintainer question with code context.

How it works

The key detail is authentication. The Ace Data Cloud gateway expects requests authenticated as Authorization: Bearer <token>. The anthropics/claude-code-action@v1 path, however, uses the Anthropic SDK convention and sends an x-api-key header.

The documented workaround is to start a local HTTP proxy inside the GitHub Actions runner. Claude Code is pointed at http://127.0.0.1:8788 through ANTHROPIC_BASE_URL. The proxy receives SDK-style requests, removes incoming authorization and x-api-key headers, injects Authorization: Bearer <ANTHROPIC_AUTH_TOKEN>, and forwards the request to https://api.acedata.cloud.

That gives you a clean boundary: GitHub stores the real token as a repository secret named ANTHROPIC_AUTH_TOKEN, the runner uses it only at runtime, and the action still receives a non-empty placeholder value for anthropic_api_key so its own validation can start.

Step 1: add the repository secret

In the target repository, add a GitHub Actions secret named ANTHROPIC_AUTH_TOKEN. In the GitHub UI, this is under Settings → Secrets and variables → Actions → New repository secret.

If you prefer the GitHub CLI, the documentation recommends setting the secret with an explicit value rather than piping from stdin accidentally:

gh secret set ANTHROPIC_AUTH_TOKEN --repo <org>/<repo> --body '<your-real-token>'

A common failure mode is a secret that was accidentally set to a literal -. If you need to debug whether the secret is present, print only its length inside the workflow, for example echo "len=${#ACEDATA_TOKEN}", not the token itself.

Step 2: create the workflow

Create .github/workflows/claude.yml. The important pieces are the trigger filter, the local proxy step, and the Claude Code action step:

name: Claude Code

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  issues:
    types: [opened, assigned]
  pull_request_review:
    types: [submitted]

jobs:
  claude:
    if: |
      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write
    env:
      ANTHROPIC_BASE_URL: http://127.0.0.1:8788
      CLAUDE_CODE_AUTO_COMPACT_WINDOW: '850000'
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Start AceData Cloud proxy (x-api-key → Bearer)
        env:
          UPSTREAM: https://api.acedata.cloud
          ACEDATA_TOKEN: ${{ secrets.ANTHROPIC_AUTH_TOKEN }}
        run: |
          python3 /tmp/proxy.py &

      - name: Run Claude Code via AceData Cloud
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: dummy-not-used
          github_token: ${{ secrets.GITHUB_TOKEN }}
          claude_args: |
            --model claude-opus-4-8
          show_full_output: 'true'

The full document includes the Python proxy body. Keep that proxy behavior unchanged: it reads UPSTREAM and ACEDATA_TOKEN, forwards GET, POST, PUT, and DELETE, strips hop-by-hop headers, and replaces SDK authentication with the Bearer token expected by the upstream gateway.

Step 3: choose a model and bound the task

The sample workflow uses --model claude-opus-4-8. The same documented section notes that you can replace it with another supported Claude model such as claude-sonnet-4-5 or claude-haiku-4-5.

You can also pass additional Claude Code arguments through claude_args:

claude_args: |
  --model claude-sonnet-4-5
  --max-turns 8

The documented parameters include --model for the model name, --max-turns for the maximum dialogue turns per task, --allowed-tools to restrict tools with comma separation, and --mcp-config for an additional MCP configuration file path.

Step 4: trigger it from an issue or PR

Once the workflow is committed, open an issue or comment on a pull request with a body that contains @claude. A simple smoke test can be as small as:

@claude Reply with: OK.

If everything is wired correctly, the GitHub Actions run starts, the local proxy listens on 127.0.0.1:8788, Claude Code sends requests through that base URL, and the bot posts the result back into the GitHub thread.

Troubleshooting notes

  • If the action fails before running, make sure anthropic_api_key is set to a non-empty placeholder such as dummy-not-used.
  • If the proxy returns 401, verify that ANTHROPIC_AUTH_TOKEN is actually populated and not accidentally set to -.
  • If no response appears after @claude, check that the event is covered by the workflow if: condition and that Actions are enabled for the repository.
  • If you need deeper debugging, inspect the workflow run and add a failure-only step to print /tmp/proxy.log.

The useful part of this setup is that it does not ask your team to leave GitHub. Maintainers keep using issues and pull requests, while the runner handles the temporary proxy and model call. For the complete workflow, including the full Python proxy implementation, read the Claude Code GitHub Actions integration guide.

Comments

Post a Comment

Popular posts from this blog

Artistic QR Code API Integration Guidance

Image
Artistic QR code is an innovative technological product that combines QR codes with beautiful background images, creating practical and visually appealing works. They not only possess the functionality of traditional QR codes, allowing quick scanning and recognition by smart devices, but also incorporate artistic elements to enhance visual appeal and brand recognition. Some artistic QR codes are even generated by artificial intelligence, fully leveraging modern technology to demonstrate unparalleled innovation and uniqueness. This makes artistic QR codes widely applicable in areas such as brand marketing and advertising. In simple terms, artistic QR codes are the perfect combination of QR code scanning and artistic aesthetics. They not only provide the function of information transmission, but also enhance the user's visual experience, making each scan a delightful artistic enjoyment. Overview of Artworks Let's take a look at a few QR code works: How are they? These are ar...
Read more
Image
Nexior is an open-source project on GitHub that allows us to deploy our AI application site with one click, including AI Q&A, Midjourney drawing, knowledge base Q&A, artistic QR codes, and more. There is no need to develop AI systems, purchase AI accounts, worry about API support, or configure payment systems. It comes with zero startup costs and allows you to earn income through AI without risk. This article will introduce the deployment process of the Nexior project on Vercel. Without any programming skills, you can deploy your AI site in a few minutes and easily generate revenue. Preparation First, open the Nexior GitHub repository at: https://github.com/AceDataCloud/Nexior , then register or log in to your GitHub account. Click Fork to clone the code to your local repository, as shown below: After completing the Fork, we will get our personal repository, as shown below: In this example, the account is Germey, so we can see that we have Forked to the Germey user, wit...
Read more

How to Configure Claude Code with CC Switch and Ace Data Cloud

Image
If you use Claude Code across a terminal, VS Code, or remote development setup, the awkward part is often not the model itself but the configuration: where should requests go, where should the token live, and how do you switch providers without editing files by hand? This guide walks through a practical setup using CC Switch as the graphical configuration manager and Ace Data Cloud as the Anthropic-compatible base URL. The goal is simple: configure Claude Code once, verify the active endpoint, and keep the setup easy to change later. What you can do With the setup described in the Ace Data Cloud documentation, you can: Manage Claude Code provider configuration through a desktop UI instead of manually editing settings.json . Store an Ace Data Cloud provider with ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN . Switch the active Claude Code provider from CC Switch without rewriting your configuration every time. Use the same provider configuration from the terminal an...
Read more